{"generated_at":"2026-10-23T14:58:30.992Z","count":5,"incidents":[{"id":"next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ret","url":"https://pwned.coffee/i/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ret","title":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","summary":"## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays. ## Workaround There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your…","severity":"critical","patch_status":"patched","status":"live","exploited":false,"affected":"next (npm)","fixed_versions":["next 16.4.1"],"ids":[],"stack":["npm","nextjs"],"first_seen":"2026-10-22T16:42:31Z","updated_at":"2026-10-22T16:42:31Z"},{"id":"sentry-javascript-middleware-bypass-when-using-tunnel-ro-cve-2026-114139","url":"https://pwned.coffee/i/sentry-javascript-middleware-bypass-when-using-tunnel-ro-cve-2026-114139","title":"Sentry-Javascript: Middleware Bypass when using Tunnel route","summary":"### Impact The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them. The middleware skip was wider…","severity":"critical","patch_status":"patched","status":"live","exploited":false,"affected":"@sentry/nextjs (npm)","fixed_versions":["@sentry/nextjs 9.47.2","@sentry/nextjs 10.75.2","@sentry/nextjs 11.0.0-rc.1"],"ids":["CVE-2026-114139"],"stack":["npm","nextjs"],"first_seen":"2026-10-22T15:55:07Z","updated_at":"2026-10-22T15:55:07Z"},{"id":"next-js-unauthenticated-remote-code-execution-in-image-optimization-api","url":"https://pwned.coffee/i/next-js-unauthenticated-remote-code-execution-in-image-optimization-api","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","summary":"## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. ## Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of…","severity":"critical","patch_status":"patched","status":"live","exploited":false,"affected":"next (npm)","fixed_versions":["next 15.5.28","next 16.4.1"],"ids":[],"stack":["npm","nextjs"],"first_seen":"2026-10-22T15:52:53Z","updated_at":"2026-10-22T15:52:53Z"},{"id":"next-js-remote-code-execution-in-next-og-imageresponse","url":"https://pwned.coffee/i/next-js-remote-code-execution-in-next-og-imageresponse","title":"Next.js: Remote Code Execution in next/og ImageResponse","summary":"## Impact The Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: ```tsx import { ImageResponse } from 'next/og' export async function GET(request:…","severity":"critical","patch_status":"patched","status":"past","exploited":false,"affected":"next (npm)","fixed_versions":["next 16.3.6"],"ids":[],"stack":["npm","nextjs"],"first_seen":"2026-09-30T14:48:30Z","updated_at":"2026-09-30T14:48:30Z"},{"id":"meta-react-server-components-remote-code-execution-vulne-cve-2025-55182","url":"https://pwned.coffee/i/meta-react-server-components-remote-code-execution-vulne-cve-2025-55182","title":"Meta React Server Components Remote Code Execution Vulnerability","summary":"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182. Added to CISA KEV on 2025-12-05 (federal deadline 2025-12-12).","severity":"critical","patch_status":"patched","status":"past","exploited":true,"affected":"Meta React Server Components","fixed_versions":[],"ids":["CVE-2025-55182"],"stack":["nextjs","react"],"first_seen":"2025-12-05T12:00:00.000Z","updated_at":"2025-12-05T12:00:00.000Z"}]}